I have a search which counts all ids events of the last 12 months by the severity. This search needs really long to run. So I dont want to rerun it every month for the complete time range of 12 months. I would like to just add the last month and search this over 6 monts.
My actual search is following:
index=ids earliest="-1year@month" latest="@month"
| fields severity | timechart count by severity span=1mon
Thank you in advance
Create a summary index which you add to every month then query that index for longer periods